What’s Vulnerable › Vulnerabilities

CVE-2026-104069: HortusFox < 6.2 Remote Code Execution via Theme Import

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-27
• Weakness: CWE-434

Description

HortusFox before 6.2 contains a remote code execution vulnerability in ThemeModule::startImport() where an uploaded ZIP archive is extracted directly into the public web root before any validation of file names, extensions, or content is performed. An authenticated administrator can upload a crafted theme archive containing a PHP file and an .htaccess file to re-enable execution, then request it under the themes directory to execute arbitrary OS commands as the web-server user.

Affected products

• danielbrendel hortusfox-web: before 6.2 — fixed in 6.2

How to fix

Upgrade to a fixed version: danielbrendel hortusfox-web 6.2. Check the vendor advisory for mitigations.

References

• https://github.com/danielbrendel/hortusfox-web/commit/3b87393d38ce408ec6f0946ffb3cbf0d08b5f07c
• https://github.com/danielbrendel/hortusfox-web/releases/tag/v6.2
• https://www.vulncheck.com/advisories/hortusfox-remote-code-execution-via-theme-import

Get alerted when CVE-2026-104069 or the next vulnerability affects your stack